Kishan0725 Hospital Management System SQL Injection Vulnerability in Doctor Deletion Logic

A SQL injection vulnerability has been identified in Kishan0725 Hospital Management System version 4, within the admin-panel1.php file. The issue arises in the logic for deleting doctors, where the application inadequately sanitizes or parameterizes user input from the 'demail' parameter. This oversight allows authenticated users to execute arbitrary database commands, potentially leading to full data exposure, data corruption, and, through advanced database techniques, server-side code execution.

Impact

Exploitation of this vulnerability allows for SQL injection, with potential impacts including unauthorized data access, data manipulation, and execution of server-side code.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to admin-panel1.php with the 'demail' parameter. The request should include a crafted SQL payload that exploits the lack of input sanitization, such as appending SQL control characters to manipulate the SQL query execution.